vdso: Defer handling untill all zones are restored

In worst case we might be tryin to proxify vdso zone
when vvar only is remmaped but vdso itself is not yet
(left and right zones shifting). Thus vdso_proxify
will complain that vdso is not yet mapped refusing
to restore.

Thus wait until everything is re-mapped then call
for proxification helper.

Reported: Mr. Jenkins
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Andrew Vagin <avagin@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
zdtm: rollback cwd only if a test case is executed in namespaces

$ bash test/zdtm.sh -i 0 '\(ns/static/env00\|static/pty03\|static/mountpoints\)'
...
==================================== ERROR ====================================
Test: zdtm/live/static/mountpoints, Namespace:
Output file: /root/git/1/criu/test/zdtm/live/static/mountpoints.out
------------------------------------------------------------------------------
00:53:03.267: 26935: FAIL: mountpoints.c:139: Can't umount all the filesystems (errno = 16 (Device or resource busy))
------------------------------------- END -------------------------------------
================================= ERROR OVER =================================

Fixes: 0198590c5a44 (zdtm: Factor out starting the test via Makefule)
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
mount: execute collect shared for all mounts

Currently collect_shared is executed for each mount namespace separately,
so we miss the dependencies between namespaces.

For example, we have two namespaces, the first one contains a tmpfs mount
and the second one contains a non-root bind-mount of this tmpfs. Without
this patch this example can't be dumped.

On restore mnt_build_tree() is called for all namespaces at once, thus
this bug doesn't exist there.

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
mount: save remapped links on tmpfs (v2)

For that mnt namespaces should be dumped after files.

v2: rework enumeration of namespaces in dump_mnt_namespaces()
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
mount: add helper mntns_get_root_by_mnt_id

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
ghost: create ghost devices and directories in a specified ns

Here is a bug now. A path for devices and directories should be
generated with a specified root.

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
file: use ralative path for retoring files

openat() is used to open files, so absolute pathes can't be used

v2: change the comment
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
make: test: rpc: don't forget to delete rpc_pb2.pyc

When performing "make clean" rpc_pb2.pyc should be deleted as well.

Signed-off-by: Ruslan Kuprieiev <kupruser@gmail.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
make: clean at test/rpc when performing "make clean" from main dir

Signed-off-by: Ruslan Kuprieiev <kupruser@gmail.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
rst: Check for task->state to restore in one place

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
files-reg: Don't dereference pointer before its NULL check

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
files-reg: Sanitize rlb and rlb->path malloc/rollback code flow

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
files: Don't double-close the image fd on error

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
util: Don't xfree pointer on xmalloc-ed pointer

... free the pointer itself :)

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
vdso: x86 -- Simplify vdso_proxify

No need for second if() statement, merge everything
in previous one.

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
vdso: x86 -- Fix missing ability to remap vDSO if only one zone present

Occasionally I ruined the ability to do a in-place remap for
pre 3.16 kernels. Bring it back.

CID 1230182:  Logically dead code  (DEADCODE)

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
vdso: restorer -- Don't forget to access proper vma from the list

Otherwise we might take a look on last vma from previous
cycle not running vdso analisys at all.

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
security: check additional groups,v5

Currently, we only check if process gids match primary gid of user.
But process and user have additional groups too. So lets:
     1) check that process rgid,egid and sgid are in the user's grouplist.
     2) on restore check that user has all groups from the images.

Signed-off-by: Ruslan Kuprieiev <kupruser@gmail.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
security: rename check_ids to check_uids and drop crid argument, v3

Currently check_ids is used to check uids only. So lets rename it
and drop crid argument, as we can use cr_uid directly.

Signed-off-by: Ruslan Kuprieiev <kupruser@gmail.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
test: security

This test creates 2 users to check how secure is using criu with setuid bit set.

Signed-off-by: Ruslan Kuprieiev <kupruser@gmail.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>